CVE-2023-36765
published 2023-09-12CVE-2023-36765: Microsoft Office Elevation of Privilege Vulnerability
PriorityP348critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.00%
58.9th percentile
Microsoft Office Elevation of Privilege Vulnerability
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | microsoft_office_2019 | >= 19.0.0 < https://aka.ms/OfficeSecurityReleases | https://aka.ms/OfficeSecurityReleases |
| microsoft | office | — | — |
| msrc | microsoft_office_2019_for_32-bit_editions | — | — |
| msrc | microsoft_office_2019_for_64-bit_editions | — | — |
| tianocore | edk2 | >= 0 < 0~20191122.bd85bf54-2ubuntu3.5 | 0~20191122.bd85bf54-2ubuntu3.5 |
| tianocore | edk2 | >= 0 < 2022.02-3ubuntu0.22.04.2 | 2022.02-3ubuntu0.22.04.2 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_msrc7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
edk2 vulnerabilities
osv·2024-02-15·CVSS 7.8
CVE-2022-36763 edk2 vulnerabilities
edk2 vulnerabilities
Marc Beatove discovered buffer overflows exit in EDK2. An attacker on the
local network could potentially use this to impact availability or possibly
cause remote code execution. (CVE-2022-36763, CVE-2022-36764,
CVE-2022-36765)
It was discovered that a buffer overflows exists in EDK2's Network Package
An attacker on the local network could potentially use these to impact
availability or possibly cause remote code execution. (CVE-2023-45230,
CVE-2023-45234, CVE-2023-45235)
It was discovered that an out-of-bounds read exists in EDK2's Network
Package An attacker on the local network could potentially use this to
impact confidentiality. (CVE-2023-45231)
It was discovered that infinite-loops exists in EDK2's Network Package
An attacker on the local network could potent
GHSA
GHSA-33wv-m292-g2pv: Microsoft Office Elevation of Privilege Vulnerability
ghsa_unreviewed·2023-09-12
CVE-2023-36765 [CRITICAL] CWE-269 GHSA-33wv-m292-g2pv: Microsoft Office Elevation of Privilege Vulnerability
Microsoft Office Elevation of Privilege Vulnerability
Microsoft
Microsoft Office Elevation of Privilege Vulnerability
vendor_msrc·2023-09-12·CVSS 7.8
CVE-2023-36765 [HIGH] Microsoft Office Elevation of Privilege Vulnerability
Microsoft Office Elevation of Privilege Vulnerability
FAQ: Is the Preview Pane an attack vector for this vulnerability?
No, the Preview Pane is not an attack vector.
FAQ: What privileges could be gained by an attacker who successfully exploited this vulnerability?
An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.
Microsoft Office: Microsoft Office
Microsoft: Microsoft
Customer Action Required: Yes
Impact: Elevation of Privilege
Exploit Status: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely
Remediation: Click to Run
Reference: https://docs.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates
No detection rules found.
No public exploits indexed.
2023-09-12
Published